Pricing
Free to run. Paid to not have to.
The open index is free to run. Enterprise is the layer that runs it for your organization: a tenant index, a portal, policy, SSO and audit, in our cloud or in your boundary.
Open source
Community
Apache-2.0, one monorepo
$0
- Protocol, index and OIDC provider, SDKs, CLI and fake phone, dashboard, phone app, design system
- Path A login and Path B MFA, Verification API, back-channel logout
- Instant revocation with back-channel logout to every connected site
- Personal identities on the public index at no cost
- Self-host the open index with one Worker deploy or one container; federate over WebFinger
- Community support on GitHub
Identizen Cloud · On-prem
Enterprise
Available today. Your own index, run for your organization, in our cloud or in yours.
Per active device / month
Two plans, standard and dedicated. Talk to us for a quote; personal identities on the public index stay free.
- A dedicated tenant index: your own issuer, signing keys and Postgres, in the US or the EU
- Admin portal and org app: users and roles, devices, approvals, sessions, two audit logs
- Enrollment by link, QR or MDM; fleet console; Intune and Jamf recipes
- Login policy: managed devices only, biometric class, login windows, session age
- SSO apps, a SAML 2.0 identity provider, SCIM 2.0 from Okta or Entra
- Audit export, signed SIEM webhooks, retention, status page and quotas
- On-prem edition: signed containers, compose bundle, Helm chart, license
Professional services
Implementation, migration from an existing IdP, custom SDK work, on-site rollout. Quoted separately.
Cloud or on-prem
Same code, two places to run it
Identizen Cloud is a dedicated tenant index per organization, provisioned by us on request. On-prem is the same edition packaged for your own boundary.
| Included | Identizen Cloud | On-prem |
|---|---|---|
| Tenant index | Dedicated issuer, keys and Postgres at {tenant}.index.identizen.com | The same index in your own containers, on your own hostnames |
| Admin portal | Included | Included |
| Org app for members | Included | Included |
| Enrollment, fleet console, MDM | Included | Included |
| Login policy | Included | Included |
| SSO apps, SAML IdP, SCIM 2.0 | Included | Included |
| Audit export, SIEM webhooks, retention | Included | Included |
| Status page and quotas | Included | Included |
| Key rotation | Run by Identizen, with overlap | Run by you, documented in the runbook |
| Data residency | US or EU, fixed at provisioning | Wherever you run it |
| License | None; a subscription | A signed license with seat count and 14-day grace |
| Packaging | Operated by Identizen | Signed images with SBOMs, compose bundle, Helm chart |
| Phone-home | Not applicable | None; air-gapped installs supported |
Everything in the table exists today. What is still on the roadmap is listed, with no dates, in the enterprise docs.
How you are billed
Active devices, per month
The metric is the number of phones on your tenant index that were used in the last 30 days. The tenant index counts them once a day, and a period is billed on its peak, at the rate in your order form. You are billed monthly per active device, by card through Stripe or by invoice under an enterprise agreement. Members who never sign in, sites, apps and administrators cost nothing.
Both plans include every capability above; they differ in isolation and quotas. Identizen can raise any quota for a tenant. The on-prem license is priced on the same metric and carries a seat count sized to your fleet.
Standard
A tenant on shared infrastructure with its own database, keys and namespaces.
- Members
- 500
- Devices
- 2,000
- SSO apps
- 20
- SCIM tokens
- 5
- Webhooks
- 5
Dedicated
Its own connection pooling and higher quotas, for larger fleets.
- Members
- 5,000
- Devices
- 20,000
- SSO apps
- 100
- SCIM tokens
- 20
- Webhooks
- 20
FAQ
Questions
Is Identizen open source?
Identizen is open core. The protocol, the index and every route it serves, the database schema and migrations, the SDKs, the CLI and fake phone, the design system, the personal dashboard and the mobile app are Apache-2.0 and stay that way. What is proprietary is the layer that runs the open index for an organization.
What exactly is proprietary?
The multi-tenant control plane (tenant provisioning, sealed secrets, hostnames), the admin portal and org app, the enterprise extensions to the index (the org API, enrollment, fleet and MDM, login policy, the SAML identity provider, SCIM, audit export, SIEM webhooks, retention and status) and the on-prem packaging with its license. Nothing in it changes what the open index promises, and nothing in it holds a private key.
Can I self-host?
Yes. The open index runs on your own Cloudflare account or in a container, for free, with no license and no seat count; the self-hosting guide covers it. The on-prem enterprise edition, which adds the portal, policy, SSO, SCIM and audit export inside your boundary, needs a license.
What counts as an active device?
A phone on your tenant index that is not disabled or revoked and was used in the last 30 days: it approved a login, drained its inbox, started a session, or was enrolled. The tenant index counts them once a day, and a period is billed on its peak. Personal identities on the public index stay free.
Can we leave?
Yes. The portal exports the audit log and the organization data as CSV or JSON, the protocol and the index are open, and every site integrates over standard OpenID Connect, so nothing at the integration boundary is ours. Phones register with one index at a time, so moving to another index means re-enrolling them.
Do you ever hold a private key?
Never. The org can enroll, disable, and revoke devices. It cannot log in as a user, and neither can we.